1. Field of the Invention
Concepts described herein relate generally to network access, and more particularly, to network access control systems.
2. Description of Related Art
Organizations are continuously looking to prevent security threats from compromising their internal networks and endpoints (e.g., devices connected to the networks). When endpoints connect to an internal network, such as a proprietary corporate network, it is often desirable for the internal network to perform security checks of the connecting endpoints before granting the endpoint access to the internal network. The security checks may include checks relating to proof of identity of the user using the endpoint, proof of identity of the endpoint itself, and checks relating to the integrity status of the endpoint. The system that performs the security check and selectively grants access to endpoints will be referred to as an endpoint integrity system herein.
The endpoint integrity system may check proof of identity of the user on an endpoint using, for example, password based checks. An integrity status check may include determining the relative purity of the endpoint from software, hardware, and configurations that are considered harmful to the endpoint itself and to other devices with which it interacts. Examples of harmful software that may be inadvertently downloaded onto an endpoint include computer viruses or Trojans.
An endpoint integrity system may use evaluation modules to assist in the various proof of identity and integrity status checks. Each evaluation module may check a different aspect relating to the identity or integrity status of the endpoint. The results of the evaluation modules are then combined into an overall result for an endpoint.
In existing systems, evaluation modules may return a multi-state result that defines the output of the evaluation module. For example, each evaluation module may return an indication that the result of the security policy implemented by the evaluation module is “allow”, “no access”, “isolate”, or “no recommendation”. The results of the evaluation modules may then be combined to determine an overall result for the endpoint.